Skip to main content

Learn Learning paths Courses

Cron Ran curl at Three in the Morning

Write detection rules, then run the response playbook

중급 · Lessons 12 · Lab 4

Curriculum

Where the trail is kept, and where it is not

A rule is a data structure, not a sentence

A rule is a data structure, not a sentence reading
Rewrite one rule six times lab
Quiz: reading Sigma rules quiz

Syscalls cannot lie to you

Catch it at the syscall and it cannot lie reading
Cron ran curl at three in the morning lab
Quiz: runtime detection quiz

What comes first after the alert

What comes first after the alert reading
Reconstruct one hour of that night lab
Quiz: order of response quiz

Reference docs